Objective-C

ebay: Add Digital Signature to HTTP Request

See more eBay Examples

Demonstrates how to add a digital signature to an ebay HTTP request. Objective-C

#import <NSString.h>
#import <CkoStringBuilder.h>
#import <CkoDateTime.h>
#import <CkoBinData.h>
#import <CkoPrivateKey.h>
#import <CkoEdDSA.h>
#import <CkoHttp.h>
#import <CkoHttpResponse.h>

BOOL success = NO;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: Ebay provides a Key Management API
// See https://developer.ebay.com/api-docs/developer/key-management/overview.html

// The following test keys can be used: 
// 
// Ed25519 
// 
// Private Key:
// 
// -----BEGIN PRIVATE KEY-----
// MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF
// -----END PRIVATE KEY-----

NSString *strPrivateKey = @"MC4CAQAwBQYDK2VwBCIEIJ+DYvh6SEqVTm50DFtMDoQikTmiCqirVv9mWG9qfSnF";

// 
// Public Key:
// 
// -----BEGIN PUBLIC KEY-----
// MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=
// -----END PUBLIC KEY-----

NSString *strPublicKey = @"MCowBQYDK2VwAyEAJrQLj5P/89iXES9+vFgrIy29clF9CC/oPPsw3c5D0bs=";

// This example assumes you got a JWE for your given private key from the Ebay Key Management REST API.
// This JWE is just for example:
NSString *strJwe = @"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiSXh2dVRMb0FLS0hlS0Zoa3BxQ05CUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiaFd3YjNoczk2QzEyOTNucCJ9.2o02pR9SoTF4g_5qRXZm6tF4H52TarilIAKxoVUqjd8.3qaF0KJN-rFHHm_P.AMUAe9PPduew09mANIZ-O_68CCuv6EIx096rm9WyLZnYz5N1WFDQ3jP0RBkbaOtQZHImMSPXIHVaB96RWshLuJsUgCKmTAwkPVCZv3zhLxZVxMXtPUuJ-ppVmPIv0NzznWCOU5Kvb9Xux7ZtnlvLXgwOFEix-BaWNomUAazbsrUCbrp514GIea3butbyxXLNi6R9TJUNh8V2uan-optT1MMyS7eMQnVGL5rYBULk.9K5ucUqAu0DqkkhgubsHHw";

CkoStringBuilder *sbBody = [[CkoStringBuilder alloc] init];
[sbBody Append: @"{\"hello\": \"world\"}"];

NSLog(@"%@",@"Body of request:");
NSLog(@"%@",[sbBody GetAsString]);

// -------------------------------------------------
// Build the signature base string...

CkoStringBuilder *sbSigBase = [[CkoStringBuilder alloc] init];

[sbSigBase Append: @"\"content-digest\": sha-256=:"];
[sbSigBase Append: [sbBody GetHash: @"sha256" encoding: @"base64" charset: @"utf-8"]];
[sbSigBase Append: @":\n"];

[sbSigBase Append: @"\"x-ebay-signature-key\": "];
[sbSigBase Append: strJwe];
[sbSigBase Append: @"\n"];

[sbSigBase Append: @"\"@method\": POST\n"];

// This is the path part of the URL without query params...
[sbSigBase Append: @"\"@path\": "];
[sbSigBase Append: @"/verifysignature"];
[sbSigBase Append: @"\n"];

// The is the domain, such as "api.ebay.com" w/ port if the port is something unusual.
// In this example, we're testing against a local docker test server (see the info at https://developer.ebay.com/develop/guides/digital-signatures-for-apis)
// Normally, I think it would just be "api.ebay.com" instead of "localhost:8080".
[sbSigBase Append: @"\"@authority\": "];
[sbSigBase Append: @"localhost:8080"];
[sbSigBase Append: @"\n"];

[sbSigBase Append: @"\"@signature-params\": "];

CkoStringBuilder *sbSigInput = [[CkoStringBuilder alloc] init];
[sbSigInput Append: @"(\"content-digest\" \"x-ebay-signature-key\" \"@method\" \"@path\" \"@authority\")"];
[sbSigInput Append: @";created="];

CkoDateTime *dt = [[CkoDateTime alloc] init];
[dt SetFromCurrentSystemTime];
NSString *unixTimeNow = [dt GetAsUnixTimeStr: NO];
[sbSigInput Append: unixTimeNow];

[sbSigBase AppendSb: sbSigInput];

// -------------------------------------------------
// Sign the signature base string using the Ed25519 private key

CkoBinData *bdPrivKey = [[CkoBinData alloc] init];
[bdPrivKey AppendEncoded: strPrivateKey encoding: @"base64"];

CkoPrivateKey *privKey = [[CkoPrivateKey alloc] init];
success = [privKey LoadAnyFormat: bdPrivKey password: @""];
if (success == NO) {
    NSLog(@"%@",privKey.LastErrorText);
    return;
}

CkoBinData *bdToBeSigned = [[CkoBinData alloc] init];
[bdToBeSigned AppendSb: sbSigBase charset: @"utf-8"];

CkoEdDSA *eddsa = [[CkoEdDSA alloc] init];
NSString *sigBase64 = [eddsa SignBdENC: bdToBeSigned encoding: @"base64" privkey: privKey];
if (eddsa.LastMethodSuccess == NO) {
    NSLog(@"%@",eddsa.LastErrorText);
    return;
}

NSLog(@"%@",@"sigBase64:");
NSLog(@"%@",sigBase64);

// ----------------------------------------------------------
// Send the JSON POST

CkoHttp *http = [[CkoHttp alloc] init];

[http SetRequestHeader: @"x-ebay-signature-key" value: strJwe];

CkoStringBuilder *sbContentDigestHdr = [[CkoStringBuilder alloc] init];
[sbContentDigestHdr Append: @"sha-256=:"];
[sbContentDigestHdr Append: [sbBody GetHash: @"sha256" encoding: @"base64" charset: @"utf-8"]];
[sbContentDigestHdr Append: @":"];
[http SetRequestHeader: @"Content-Digest" value: [sbContentDigestHdr GetAsString]];

CkoStringBuilder *sbSigHdr = [[CkoStringBuilder alloc] init];
[sbSigHdr Append: @"sig1=:"];
[sbSigHdr Append: sigBase64];
[sbSigHdr Append: @":"];
[http SetRequestHeader: @"Signature" value: [sbSigHdr GetAsString]];

[sbSigInput Prepend: @"sig1="];
[http SetRequestHeader: @"Signature-Input" value: [sbSigInput GetAsString]];

// Add this header to make eBay actually check the signature.
[http SetRequestHeader: @"x-ebay-enforce-signature" value: @"true"];

// Set the OAuth2 access token to add the "Authorization: Bearer <access_token>" to the header.
http.AuthToken = @"your_oauth2_access_token";

// The signature base string constructed above is valid if we send this POST to "http://localhost:8080/verifysignature"
// Normally, you'll send your POST to some api.ebay.com endpoint.
NSString *url = @"http://localhost:8080/verifysignature";

NSString *jsonStr = [sbBody GetAsString];
CkoHttpResponse *resp = [[CkoHttpResponse alloc] init];
success = [http HttpStr: @"POST" url: @"http://localhost:8080/verifysignature" bodyStr: jsonStr charset: @"utf-8" contentType: @"application/json" response: resp];
if (success == NO) {
    NSLog(@"%@",http.LastErrorText);
    return;
}

NSLog(@"%@%d",@"Response status code: ",[resp.StatusCode intValue]);
NSLog(@"%@",@"Response body:");
NSLog(@"%@",resp.BodyStr);